The Internet Archive is one of the internet's most important institutions: a non-profit library that has crawled and preserved web pages since 1996, maintaining the Wayback Machine with over 866 billion web captures, digitized books, and historical software. Brewster Kahle founded it with an explicit mission of "universal access to all knowledge." In October 2024, it was breached - user data for 31 million accounts was stolen and its support ticket system was compromised, allowing attackers to access and respond to user communications using stolen credentials. The breach happened not through a sophisticated exploit but through an exposed Gitlab token and, separately, a Zendesk configuration that had been flagged to the Archive months before it was actually exploited.
The Internet Archive hack arrived alongside a DDoS campaign from a different actor entirely - the pro-Palestinian hacktivist group SN_Blackmeta, which flooded the Archive's servers with traffic in protest of its preservation of material they considered pro-Israeli. The two incidents were unrelated but simultaneous, creating confusion about what was happening and making the organization's response more difficult. It was a bad week for digital preservation.
The Data Breach: What Was Taken
The database breach exposed the personal information of approximately 31 million Internet Archive users. The stolen data included: email addresses, screen names, password change timestamps, bcrypt-hashed passwords, and some other internal user data. The bcrypt hashing is significant - bcrypt is a strong password hashing algorithm with a work factor that makes brute-force cracking computationally expensive. Users with strong, unique passwords were at minimal risk from the hash exposure; users with weak passwords were at some risk.
The breach was disclosed not by the Internet Archive but by Troy Hunt, the creator of Have I Been Pwned. An anonymous individual sent Hunt a 6.4 GB SQL database dump and claimed it was from the Internet Archive. Hunt confirmed its authenticity by contacting users whose data appeared in the dump and asking them to verify their account details matched. On October 9, 2024, Have I Been Pwned sent breach notification emails to users whose data appeared in the dump. The notification came before the Archive had publicly disclosed the breach.
Users noticed when the Internet Archive's website began displaying a JavaScript popup - apparently injected by the attackers - reading: "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of a catastrophic security failure? It just happened. See 31 million of you on HIBP!" The popup was sourced from a domain the attackers controlled. This was the public announcement the Archive had not made.
The Zendesk Token Compromise
The second breach vector was more damaging in terms of operational impact. The Internet Archive used Zendesk for its support ticket system, and at some point a Zendesk API token with broad access to the support system was exposed. The attackers used this token to gain access to all support tickets submitted to the Internet Archive - potentially including personal information, DMCA takedown requests with personal identifying details, and communications from researchers, archivists, and other users.
More significantly, the compromised Zendesk access allowed the attackers to read and respond to support tickets as if they were Internet Archive staff. Messages purportedly from the Archive's support team were sent to researchers and users who had submitted tickets, some of which contained sensitive operational details and internal system information. The attackers used this access to taunt both users and security researchers who were investigating the breach.
The Zendesk token had reportedly been flagged as exposed in prior months by a security researcher who had reported it through the Archive's bug disclosure process. The organization had not rotated the token before the attackers used it. This is the same class of failure that produced the 2022 CircleCI breach and dozens of others: a credential exposed in a location accessible to attackers (in this case, reportedly in a Gitlab repository) that was known to the organization but not acted upon before exploitation.
The DDoS Campaign
SN_Blackmeta, a group that claims pro-Palestinian motivations and has targeted Israeli and Israeli-adjacent organizations, conducted a separate DDoS campaign against the Internet Archive during the same period. The group claimed the Archive's preservation of Israeli government and media websites made it a legitimate target. Their campaign generated enough traffic to intermittently take the Wayback Machine offline.
The Internet Archive has no intrinsic connection to the Israeli-Palestinian conflict - it preserves web content from all countries and all perspectives as a matter of institutional mission. The targeting appeared to reflect a maximalist interpretation of what constitutes "supporting" Israeli institutions: the mere existence of archived copies of Israeli websites was sufficient. This logic, if applied consistently, would make any web archiving service a legitimate DDoS target.
The simultaneity of the DDoS and the data breach created genuine confusion for users and journalists reporting on the incident. For several hours it was unclear whether the Archive was experiencing a technical failure, a DDoS, a breach, or some combination. The attackers behind the data breach and the DDoS attackers were later confirmed to have no connection to each other.
The Archive's Response
Brewster Kahle's public communications during the incident were notably transparent. He acknowledged the breach quickly after the HIBP disclosure, confirmed the Zendesk compromise, and provided regular updates on the organization's recovery efforts. The Archive took its services offline temporarily to investigate, and brought the Wayback Machine back in read-only mode before restoring full functionality.
The organization's security posture - strong bcrypt password hashing, relatively contained database exposure - reflected better-than-average practices for a non-profit operating on limited resources. The failures were in credential management (the exposed Zendesk token) and in incident response to the prior tip-off about the exposure.
The breach generated significant discussion in the archiving and library community about the security obligations of organizations that hold historical records and personal data at scale. The Internet Archive is in an unusual position: its mission requires it to preserve data in perpetuity, which creates long-tail risks from old user accounts and data. Users who created accounts decades ago for a one-time purpose may not even remember their credentials exist in the Archive's systems.
What the Breach Reveals About Non-Profit Security
The Internet Archive breach is illustrative of a structural problem in non-profit and academic institution security. Organizations with missions focused on access and preservation rather than security, operating on constrained budgets with small technical teams, face the same threat landscape as commercial companies with dedicated security engineering departments - but with a fraction of the resources to respond to it.
The specific failure modes here - exposed credentials in source code, slow rotation of flagged tokens, reliance on SaaS providers with broad data access - are exactly the failure modes that well-resourced organizations have had the most success addressing in recent years through secrets scanning automation, credential rotation policies, and vendor access reviews. These are not difficult problems to solve technically; they require budget, process, and organizational attention.
The Internet Archive's case generated significant goodwill from the security community, which generally regards the Archive as a net positive for the internet and for research. The breach prompted donations and offers of assistance. But goodwill does not protect user data, and the 31 million people whose email addresses and password hashes are now in breach databases did not consent to their data being included in the cost of keeping the Wayback Machine running.